nfnetlink_osf.c 9.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  3. #include <linux/module.h>
  4. #include <linux/kernel.h>
  5. #include <linux/capability.h>
  6. #include <linux/if.h>
  7. #include <linux/inetdevice.h>
  8. #include <linux/ip.h>
  9. #include <linux/list.h>
  10. #include <linux/rculist.h>
  11. #include <linux/skbuff.h>
  12. #include <linux/slab.h>
  13. #include <linux/tcp.h>
  14. #include <net/ip.h>
  15. #include <net/tcp.h>
  16. #include <linux/netfilter/nfnetlink.h>
  17. #include <linux/netfilter/x_tables.h>
  18. #include <net/netfilter/nf_log.h>
  19. #include <linux/netfilter/nfnetlink_osf.h>
  20. /*
  21. * Indexed by dont-fragment bit.
  22. * It is the only constant value in the fingerprint.
  23. */
  24. struct list_head nf_osf_fingers[2];
  25. EXPORT_SYMBOL_GPL(nf_osf_fingers);
  26. static inline int nf_osf_ttl(const struct sk_buff *skb,
  27. int ttl_check, unsigned char f_ttl)
  28. {
  29. struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
  30. const struct iphdr *ip = ip_hdr(skb);
  31. const struct in_ifaddr *ifa;
  32. int ret = 0;
  33. if (ttl_check == NF_OSF_TTL_TRUE)
  34. return ip->ttl == f_ttl;
  35. if (ttl_check == NF_OSF_TTL_NOCHECK)
  36. return 1;
  37. else if (ip->ttl <= f_ttl)
  38. return 1;
  39. in_dev_for_each_ifa_rcu(ifa, in_dev) {
  40. if (inet_ifa_match(ip->saddr, ifa)) {
  41. ret = (ip->ttl == f_ttl);
  42. break;
  43. }
  44. }
  45. return ret;
  46. }
  47. struct nf_osf_hdr_ctx {
  48. bool df;
  49. u16 window;
  50. u16 totlen;
  51. const unsigned char *optp;
  52. unsigned int optsize;
  53. };
  54. static bool nf_osf_match_one(const struct sk_buff *skb,
  55. const struct nf_osf_user_finger *f,
  56. int ttl_check,
  57. struct nf_osf_hdr_ctx *ctx)
  58. {
  59. const __u8 *optpinit = ctx->optp;
  60. unsigned int check_WSS = 0;
  61. int fmatch = FMATCH_WRONG;
  62. int foptsize, optnum;
  63. u16 mss = 0;
  64. if (ctx->totlen != f->ss || !nf_osf_ttl(skb, ttl_check, f->ttl))
  65. return false;
  66. /*
  67. * Should not happen if userspace parser was written correctly.
  68. */
  69. if (f->wss.wc >= OSF_WSS_MAX)
  70. return false;
  71. /* Check options */
  72. foptsize = 0;
  73. for (optnum = 0; optnum < f->opt_num; ++optnum)
  74. foptsize += f->opt[optnum].length;
  75. if (foptsize > MAX_IPOPTLEN ||
  76. ctx->optsize > MAX_IPOPTLEN ||
  77. ctx->optsize != foptsize)
  78. return false;
  79. check_WSS = f->wss.wc;
  80. for (optnum = 0; optnum < f->opt_num; ++optnum) {
  81. if (f->opt[optnum].kind == *ctx->optp) {
  82. __u32 len = f->opt[optnum].length;
  83. const __u8 *optend = ctx->optp + len;
  84. fmatch = FMATCH_OK;
  85. switch (*ctx->optp) {
  86. case OSFOPT_MSS:
  87. mss = ctx->optp[3];
  88. mss <<= 8;
  89. mss |= ctx->optp[2];
  90. mss = ntohs((__force __be16)mss);
  91. break;
  92. case OSFOPT_TS:
  93. break;
  94. }
  95. ctx->optp = optend;
  96. } else
  97. fmatch = FMATCH_OPT_WRONG;
  98. if (fmatch != FMATCH_OK)
  99. break;
  100. }
  101. if (fmatch != FMATCH_OPT_WRONG) {
  102. fmatch = FMATCH_WRONG;
  103. switch (check_WSS) {
  104. case OSF_WSS_PLAIN:
  105. if (f->wss.val == 0 || ctx->window == f->wss.val)
  106. fmatch = FMATCH_OK;
  107. break;
  108. case OSF_WSS_MSS:
  109. /*
  110. * Some smart modems decrease mangle MSS to
  111. * SMART_MSS_2, so we check standard, decreased
  112. * and the one provided in the fingerprint MSS
  113. * values.
  114. */
  115. #define SMART_MSS_1 1460
  116. #define SMART_MSS_2 1448
  117. if (ctx->window == f->wss.val * mss ||
  118. ctx->window == f->wss.val * SMART_MSS_1 ||
  119. ctx->window == f->wss.val * SMART_MSS_2)
  120. fmatch = FMATCH_OK;
  121. break;
  122. case OSF_WSS_MTU:
  123. if (ctx->window == f->wss.val * (mss + 40) ||
  124. ctx->window == f->wss.val * (SMART_MSS_1 + 40) ||
  125. ctx->window == f->wss.val * (SMART_MSS_2 + 40))
  126. fmatch = FMATCH_OK;
  127. break;
  128. case OSF_WSS_MODULO:
  129. if ((ctx->window % f->wss.val) == 0)
  130. fmatch = FMATCH_OK;
  131. break;
  132. }
  133. }
  134. if (fmatch != FMATCH_OK)
  135. ctx->optp = optpinit;
  136. return fmatch == FMATCH_OK;
  137. }
  138. static const struct tcphdr *nf_osf_hdr_ctx_init(struct nf_osf_hdr_ctx *ctx,
  139. const struct sk_buff *skb,
  140. const struct iphdr *ip,
  141. unsigned char *opts,
  142. struct tcphdr *_tcph)
  143. {
  144. const struct tcphdr *tcp;
  145. tcp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(struct tcphdr), _tcph);
  146. if (!tcp)
  147. return NULL;
  148. if (!tcp->syn)
  149. return NULL;
  150. ctx->totlen = ntohs(ip->tot_len);
  151. ctx->df = ntohs(ip->frag_off) & IP_DF;
  152. ctx->window = ntohs(tcp->window);
  153. if (tcp->doff * 4 > sizeof(struct tcphdr)) {
  154. ctx->optsize = tcp->doff * 4 - sizeof(struct tcphdr);
  155. ctx->optp = skb_header_pointer(skb, ip_hdrlen(skb) +
  156. sizeof(struct tcphdr), ctx->optsize, opts);
  157. if (!ctx->optp)
  158. return NULL;
  159. }
  160. return tcp;
  161. }
  162. bool
  163. nf_osf_match(const struct sk_buff *skb, u_int8_t family,
  164. int hooknum, struct net_device *in, struct net_device *out,
  165. const struct nf_osf_info *info, struct net *net,
  166. const struct list_head *nf_osf_fingers)
  167. {
  168. const struct iphdr *ip = ip_hdr(skb);
  169. const struct nf_osf_user_finger *f;
  170. unsigned char opts[MAX_IPOPTLEN];
  171. const struct nf_osf_finger *kf;
  172. int fcount = 0, ttl_check;
  173. int fmatch = FMATCH_WRONG;
  174. struct nf_osf_hdr_ctx ctx;
  175. const struct tcphdr *tcp;
  176. struct tcphdr _tcph;
  177. memset(&ctx, 0, sizeof(ctx));
  178. tcp = nf_osf_hdr_ctx_init(&ctx, skb, ip, opts, &_tcph);
  179. if (!tcp)
  180. return false;
  181. ttl_check = (info->flags & NF_OSF_TTL) ? info->ttl : 0;
  182. list_for_each_entry_rcu(kf, &nf_osf_fingers[ctx.df], finger_entry) {
  183. f = &kf->finger;
  184. if (!(info->flags & NF_OSF_LOG) && strcmp(info->genre, f->genre))
  185. continue;
  186. if (!nf_osf_match_one(skb, f, ttl_check, &ctx))
  187. continue;
  188. fmatch = FMATCH_OK;
  189. fcount++;
  190. if (info->flags & NF_OSF_LOG)
  191. nf_log_packet(net, family, hooknum, skb,
  192. in, out, NULL,
  193. "%s [%s:%s] : %pI4:%d -> %pI4:%d hops=%d\n",
  194. f->genre, f->version, f->subtype,
  195. &ip->saddr, ntohs(tcp->source),
  196. &ip->daddr, ntohs(tcp->dest),
  197. f->ttl - ip->ttl);
  198. if ((info->flags & NF_OSF_LOG) &&
  199. info->loglevel == NF_OSF_LOGLEVEL_FIRST)
  200. break;
  201. }
  202. if (!fcount && (info->flags & NF_OSF_LOG))
  203. nf_log_packet(net, family, hooknum, skb, in, out, NULL,
  204. "Remote OS is not known: %pI4:%u -> %pI4:%u\n",
  205. &ip->saddr, ntohs(tcp->source),
  206. &ip->daddr, ntohs(tcp->dest));
  207. if (fcount)
  208. fmatch = FMATCH_OK;
  209. return fmatch == FMATCH_OK;
  210. }
  211. EXPORT_SYMBOL_GPL(nf_osf_match);
  212. bool nf_osf_find(const struct sk_buff *skb,
  213. const struct list_head *nf_osf_fingers,
  214. const int ttl_check, struct nf_osf_data *data)
  215. {
  216. const struct iphdr *ip = ip_hdr(skb);
  217. const struct nf_osf_user_finger *f;
  218. unsigned char opts[MAX_IPOPTLEN];
  219. const struct nf_osf_finger *kf;
  220. struct nf_osf_hdr_ctx ctx;
  221. const struct tcphdr *tcp;
  222. struct tcphdr _tcph;
  223. memset(&ctx, 0, sizeof(ctx));
  224. tcp = nf_osf_hdr_ctx_init(&ctx, skb, ip, opts, &_tcph);
  225. if (!tcp)
  226. return false;
  227. list_for_each_entry_rcu(kf, &nf_osf_fingers[ctx.df], finger_entry) {
  228. f = &kf->finger;
  229. if (!nf_osf_match_one(skb, f, ttl_check, &ctx))
  230. continue;
  231. data->genre = f->genre;
  232. data->version = f->version;
  233. break;
  234. }
  235. return true;
  236. }
  237. EXPORT_SYMBOL_GPL(nf_osf_find);
  238. static const struct nla_policy nfnl_osf_policy[OSF_ATTR_MAX + 1] = {
  239. [OSF_ATTR_FINGER] = { .len = sizeof(struct nf_osf_user_finger) },
  240. };
  241. static int nfnl_osf_add_callback(struct net *net, struct sock *ctnl,
  242. struct sk_buff *skb, const struct nlmsghdr *nlh,
  243. const struct nlattr * const osf_attrs[],
  244. struct netlink_ext_ack *extack)
  245. {
  246. struct nf_osf_user_finger *f;
  247. struct nf_osf_finger *kf = NULL, *sf;
  248. int err = 0;
  249. if (!capable(CAP_NET_ADMIN))
  250. return -EPERM;
  251. if (!osf_attrs[OSF_ATTR_FINGER])
  252. return -EINVAL;
  253. if (!(nlh->nlmsg_flags & NLM_F_CREATE))
  254. return -EINVAL;
  255. f = nla_data(osf_attrs[OSF_ATTR_FINGER]);
  256. kf = kmalloc(sizeof(struct nf_osf_finger), GFP_KERNEL);
  257. if (!kf)
  258. return -ENOMEM;
  259. memcpy(&kf->finger, f, sizeof(struct nf_osf_user_finger));
  260. list_for_each_entry(sf, &nf_osf_fingers[!!f->df], finger_entry) {
  261. if (memcmp(&sf->finger, f, sizeof(struct nf_osf_user_finger)))
  262. continue;
  263. kfree(kf);
  264. kf = NULL;
  265. if (nlh->nlmsg_flags & NLM_F_EXCL)
  266. err = -EEXIST;
  267. break;
  268. }
  269. /*
  270. * We are protected by nfnl mutex.
  271. */
  272. if (kf)
  273. list_add_tail_rcu(&kf->finger_entry, &nf_osf_fingers[!!f->df]);
  274. return err;
  275. }
  276. static int nfnl_osf_remove_callback(struct net *net, struct sock *ctnl,
  277. struct sk_buff *skb,
  278. const struct nlmsghdr *nlh,
  279. const struct nlattr * const osf_attrs[],
  280. struct netlink_ext_ack *extack)
  281. {
  282. struct nf_osf_user_finger *f;
  283. struct nf_osf_finger *sf;
  284. int err = -ENOENT;
  285. if (!capable(CAP_NET_ADMIN))
  286. return -EPERM;
  287. if (!osf_attrs[OSF_ATTR_FINGER])
  288. return -EINVAL;
  289. f = nla_data(osf_attrs[OSF_ATTR_FINGER]);
  290. list_for_each_entry(sf, &nf_osf_fingers[!!f->df], finger_entry) {
  291. if (memcmp(&sf->finger, f, sizeof(struct nf_osf_user_finger)))
  292. continue;
  293. /*
  294. * We are protected by nfnl mutex.
  295. */
  296. list_del_rcu(&sf->finger_entry);
  297. kfree_rcu(sf, rcu_head);
  298. err = 0;
  299. break;
  300. }
  301. return err;
  302. }
  303. static const struct nfnl_callback nfnl_osf_callbacks[OSF_MSG_MAX] = {
  304. [OSF_MSG_ADD] = {
  305. .call = nfnl_osf_add_callback,
  306. .attr_count = OSF_ATTR_MAX,
  307. .policy = nfnl_osf_policy,
  308. },
  309. [OSF_MSG_REMOVE] = {
  310. .call = nfnl_osf_remove_callback,
  311. .attr_count = OSF_ATTR_MAX,
  312. .policy = nfnl_osf_policy,
  313. },
  314. };
  315. static const struct nfnetlink_subsystem nfnl_osf_subsys = {
  316. .name = "osf",
  317. .subsys_id = NFNL_SUBSYS_OSF,
  318. .cb_count = OSF_MSG_MAX,
  319. .cb = nfnl_osf_callbacks,
  320. };
  321. static int __init nfnl_osf_init(void)
  322. {
  323. int err = -EINVAL;
  324. int i;
  325. for (i = 0; i < ARRAY_SIZE(nf_osf_fingers); ++i)
  326. INIT_LIST_HEAD(&nf_osf_fingers[i]);
  327. err = nfnetlink_subsys_register(&nfnl_osf_subsys);
  328. if (err < 0) {
  329. pr_err("Failed to register OSF nsfnetlink helper (%d)\n", err);
  330. goto err_out_exit;
  331. }
  332. return 0;
  333. err_out_exit:
  334. return err;
  335. }
  336. static void __exit nfnl_osf_fini(void)
  337. {
  338. struct nf_osf_finger *f;
  339. int i;
  340. nfnetlink_subsys_unregister(&nfnl_osf_subsys);
  341. rcu_read_lock();
  342. for (i = 0; i < ARRAY_SIZE(nf_osf_fingers); ++i) {
  343. list_for_each_entry_rcu(f, &nf_osf_fingers[i], finger_entry) {
  344. list_del_rcu(&f->finger_entry);
  345. kfree_rcu(f, rcu_head);
  346. }
  347. }
  348. rcu_read_unlock();
  349. rcu_barrier();
  350. }
  351. module_init(nfnl_osf_init);
  352. module_exit(nfnl_osf_fini);
  353. MODULE_LICENSE("GPL");